Not really... since the value of r6 would then be unpredictable, a random address would be used, basically. E.g. it would not work properly, obviously. I fixed that already even before posting this, anyway. As for the return value, that's correct. Because variable 0x8004 is exactly 0x10 byte before 0x800D.